Railway breach exposes secrets and triggers $740,000 in AI charges

Cloud host Railway said in an incident report published November 10 that attackers used two flaws to take authentication secrets from customers and run up about $740,000 in unauthorized AI charges, CybersecurityNews reported. The incident could affect at most 100,000 workspaces. BleepingComputer reported that the report confirms customer environment variables were decrypted for no more than 1.85% of workspaces.

The first successful exploit began at 07:28 UTC on October 20, CybersecurityNews reported. An unknown vulnerability let the attacker escape the build sandbox and read files from the underlying host, revealing a credential for pushing completed images. The credential gave access to Railway's Temporal task system, where the attacker pulled history data from 353 builds. The internal codebase was exposed separately through access to cached repository snapshots.

On October 21 at 03:26 UTC, the attacker took advantage of an OpenID Connect trust misconfiguration to obtain a short-lived cloud credential and an SSH private key, CybersecurityNews said. The attacker used the key to enter a machine that coordinates customer workloads. That machine could reach the production database and held a credential that could decrypt stored secrets. Railway's investigators saw database queries looking specifically for names of AI provider keys.

In a statement reported by BleepingComputer, Railway said: "This was not a single breach followed by a single fix. The attacker probed many potential routes, in parallel, with Railway similarly hardening the routes in parallel." Railway described the roughly 26-hour incident as a contest against AI agents. The attacker used AI models with safety restrictions removed, possibly through a framework such as ARTEX, Railway said. BleepingComputer also reported that Wiz has dubbed the wider campaign "Black October."

The attacker sought AI credentials, likely to sell or use for model distillation, Railway believes. The company has not confirmed whether the intruder ran services that relay or resell AI access, CybersecurityNews reported. Railway said the stolen keys led to about $740,000 in fraudulent charges. CybersecurityNews notes the spending matches LLMjacking behavior, in which criminals use stolen credentials to run up charges on paid AI services.

Railway said the incident also exposed external account tokens for 1,852 users, such as GitHub OAuth tokens and AI agent keys. Railway reset those tokens and told the affected users, BleepingComputer reported. BleepingComputer said Railway found no sign the hackers pulled customer Git repositories. CybersecurityNews said the company saw no evidence of customer database access and no account logins using stolen credentials.

The attackers were kicked out on October 21 and the flaws they used have been fixed, Railway said, BleepingComputer reported. Builds were restored for every plan by October 22, according to CybersecurityNews. Railway is seeking refunds from AI providers and said it will pay breach-related charges if providers decline to reimburse them, BleepingComputer reported.